How to Export CrowdStrike Falcon Event Data for Investigation
Summary
Guide to exporting Falcon sensor telemetry with Advanced Event Search or Falcon Data Replicator, filtering bulk JSON by agent ID and event type, and uploading it to LogTotal[.]com. It distinguishes sensor telemetry from raw host logs and notes access and retentionlimits
Key points
- Advanced Event Search supports targeted exports in JSON or CSV; avoid using table() before export because it removes fields.
- Falcon Data Replicator sends batches of gzipped JSON to S3 and announces them through SQS; each line represents one event.
- For bulk data, the guide shows filtering FDR events by agent ID with jq and recommends filtering by agent ID and event_simpleName before upload.
- Examples of commonly used event_simpleName values include ProcessRollup2, NetworkConnectIP4, DnsRequest, and UserLogon.
- Event Search requires an appropriate Falcon role; FDR requires a subscription and an API client with FDR scope.
- Falcon sensor telemetry is not the same as raw Windows or Linux host logs, and how far back data is available depends on subscription retention.
Article Details
- Topic
- Exporting CrowdStrike Falcon event data for review and investigation
Vendors
Products
FalconFor a targeted pull, run your query in Falcon’s Advanced Event Search and export the results as JSON.Falcon Data Replicator (FDR)For bulk raw telemetry, Falcon Data Replicator (FDR) delivers your events to an S3 bucket as gzipped JSON, one event per line.LogTotalBelow is how to get it out, sanitize it, and investigate it for free in LogTotal.